net/ipv4/inet_diag.c

   1 /*
   2  * inet_diag.c  Module for monitoring INET transport protocols sockets.
   3  *
   4  * Authors:     Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
   5  *
   6  *      This program is free software; you can redistribute it and/or
   7  *      modify it under the terms of the GNU General Public License
   8  *      as published by the Free Software Foundation; either version
   9  *      2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/module.h>
  14 #include <linux/types.h>
  15 #include <linux/fcntl.h>
  16 #include <linux/random.h>
  17 #include <linux/slab.h>
  18 #include <linux/cache.h>
  19 #include <linux/init.h>
  20 #include <linux/time.h>
  21
  22 #include <net/icmp.h>
  23 #include <net/tcp.h>
  24 #include <net/ipv6.h>
  25 #include <net/inet_common.h>
  26 #include <net/inet_connection_sock.h>
  27 #include <net/inet_hashtables.h>
  28 #include <net/inet_timewait_sock.h>
  29 #include <net/inet6_hashtables.h>
  30 #include <net/netlink.h>
  31
  32 #include <linux/inet.h>
  33 #include <linux/stddef.h>
  34
  35 #include <linux/inet_diag.h>
  36 #include <linux/sock_diag.h>
  37
  38 static const struct inet_diag_handler **inet_diag_table;
  39
  40 struct inet_diag_entry {
  41         __be32 *saddr;
  42         __be32 *daddr;
  43         u16 sport;
  44         u16 dport;
  45         u16 family;
  46         u16 userlocks;
  47 };
  48
  49 #define INET_DIAG_PUT(skb, attrtype, attrlen) \
  50         RTA_DATA(__RTA_PUT(skb, attrtype, attrlen))
  51
  52 static DEFINE_MUTEX(inet_diag_table_mutex);
  53
  54 static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
  55 {
  56         if (!inet_diag_table[proto])
  57                 request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
  58                                NETLINK_SOCK_DIAG, proto);
  59
  60         mutex_lock(&inet_diag_table_mutex);
  61         if (!inet_diag_table[proto])
  62                 return ERR_PTR(-ENOENT);
  63
  64         return inet_diag_table[proto];
  65 }
  66
  67 static inline void inet_diag_unlock_handler(
  68         const struct inet_diag_handler *handler)
  69 {
  70         mutex_unlock(&inet_diag_table_mutex);
  71 }
  72
  73 static int inet_csk_diag_fill(struct sock *sk,
  74                               struct sk_buff *skb, struct inet_diag_req *req,
  75                               u32 pid, u32 seq, u16 nlmsg_flags,
  76                               const struct nlmsghdr *unlh)
  77 {
  78         const struct inet_sock *inet = inet_sk(sk);
  79         const struct inet_connection_sock *icsk = inet_csk(sk);
  80         struct inet_diag_msg *r;
  81         struct nlmsghdr  *nlh;
  82         void *info = NULL;
  83         struct inet_diag_meminfo  *minfo = NULL;
  84         unsigned char    *b = skb_tail_pointer(skb);
  85         const struct inet_diag_handler *handler;
  86         int ext = req->idiag_ext;
  87
  88         handler = inet_diag_table[req->sdiag_protocol];
  89         BUG_ON(handler == NULL);
  90
  91         nlh = NLMSG_PUT(skb, pid, seq, unlh->nlmsg_type, sizeof(*r));
  92         nlh->nlmsg_flags = nlmsg_flags;
  93
  94         r = NLMSG_DATA(nlh);
  95         BUG_ON(sk->sk_state == TCP_TIME_WAIT);
  96
  97         if (ext & (1 << (INET_DIAG_MEMINFO - 1)))
  98                 minfo = INET_DIAG_PUT(skb, INET_DIAG_MEMINFO, sizeof(*minfo));
  99
 100         if (ext & (1 << (INET_DIAG_INFO - 1)))
 101                 info = INET_DIAG_PUT(skb, INET_DIAG_INFO, sizeof(struct tcp_info));
 102
 103         if ((ext & (1 << (INET_DIAG_CONG - 1))) && icsk->icsk_ca_ops) {
 104                 const size_t len = strlen(icsk->icsk_ca_ops->name);
 105
 106                 strcpy(INET_DIAG_PUT(skb, INET_DIAG_CONG, len + 1),
 107                        icsk->icsk_ca_ops->name);
 108         }
 109
 110         r->idiag_family = sk->sk_family;
 111         r->idiag_state = sk->sk_state;
 112         r->idiag_timer = 0;
 113         r->idiag_retrans = 0;
 114
 115         r->id.idiag_if = sk->sk_bound_dev_if;
 116         r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
 117         r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
 118
 119         r->id.idiag_sport = inet->inet_sport;
 120         r->id.idiag_dport = inet->inet_dport;
 121         r->id.idiag_src[0] = inet->inet_rcv_saddr;
 122         r->id.idiag_dst[0] = inet->inet_daddr;
 123
 124         /* IPv6 dual-stack sockets use inet->tos for IPv4 connections,
 125          * hence this needs to be included regardless of socket family.
 126          */
 127         if (ext & (1 << (INET_DIAG_TOS - 1)))
 128                 RTA_PUT_U8(skb, INET_DIAG_TOS, inet->tos);
 129
 130 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 131         if (r->idiag_family == AF_INET6) {
 132                 const struct ipv6_pinfo *np = inet6_sk(sk);
 133
 134                 *(struct in6_addr *)r->id.idiag_src = np->rcv_saddr;
 135                 *(struct in6_addr *)r->id.idiag_dst = np->daddr;
 136                 if (ext & (1 << (INET_DIAG_TCLASS - 1)))
 137                         RTA_PUT_U8(skb, INET_DIAG_TCLASS, np->tclass);
 138         }
 139 #endif
 140
 141 #define EXPIRES_IN_MS(tmo)  DIV_ROUND_UP((tmo - jiffies) * 1000, HZ)
 142
 143         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
 144                 r->idiag_timer = 1;
 145                 r->idiag_retrans = icsk->icsk_retransmits;
 146                 r->idiag_expires = EXPIRES_IN_MS(icsk->icsk_timeout);
 147         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
 148                 r->idiag_timer = 4;
 149                 r->idiag_retrans = icsk->icsk_probes_out;
 150                 r->idiag_expires = EXPIRES_IN_MS(icsk->icsk_timeout);
 151         } else if (timer_pending(&sk->sk_timer)) {
 152                 r->idiag_timer = 2;
 153                 r->idiag_retrans = icsk->icsk_probes_out;
 154                 r->idiag_expires = EXPIRES_IN_MS(sk->sk_timer.expires);
 155         } else {
 156                 r->idiag_timer = 0;
 157                 r->idiag_expires = 0;
 158         }
 159 #undef EXPIRES_IN_MS
 160
 161         r->idiag_uid = sock_i_uid(sk);
 162         r->idiag_inode = sock_i_ino(sk);
 163
 164         if (minfo) {
 165                 minfo->idiag_rmem = sk_rmem_alloc_get(sk);
 166                 minfo->idiag_wmem = sk->sk_wmem_queued;
 167                 minfo->idiag_fmem = sk->sk_forward_alloc;
 168                 minfo->idiag_tmem = sk_wmem_alloc_get(sk);
 169         }
 170
 171         handler->idiag_get_info(sk, r, info);
 172
 173         if (sk->sk_state < TCP_TIME_WAIT &&
 174             icsk->icsk_ca_ops && icsk->icsk_ca_ops->get_info)
 175                 icsk->icsk_ca_ops->get_info(sk, ext, skb);
 176
 177         nlh->nlmsg_len = skb_tail_pointer(skb) - b;
 178         return skb->len;
 179
 180 rtattr_failure:
 181 nlmsg_failure:
 182         nlmsg_trim(skb, b);
 183         return -EMSGSIZE;
 184 }
 185
 186 static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
 187                                struct sk_buff *skb, struct inet_diag_req *req,
 188                                u32 pid, u32 seq, u16 nlmsg_flags,
 189                                const struct nlmsghdr *unlh)
 190 {
 191         long tmo;
 192         struct inet_diag_msg *r;
 193         const unsigned char *previous_tail = skb_tail_pointer(skb);
 194         struct nlmsghdr *nlh = NLMSG_PUT(skb, pid, seq,
 195                                          unlh->nlmsg_type, sizeof(*r));
 196
 197         r = NLMSG_DATA(nlh);
 198         BUG_ON(tw->tw_state != TCP_TIME_WAIT);
 199
 200         nlh->nlmsg_flags = nlmsg_flags;
 201
 202         tmo = tw->tw_ttd - jiffies;
 203         if (tmo < 0)
 204                 tmo = 0;
 205
 206         r->idiag_family       = tw->tw_family;
 207         r->idiag_retrans      = 0;
 208         r->id.idiag_if        = tw->tw_bound_dev_if;
 209         r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
 210         r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
 211         r->id.idiag_sport     = tw->tw_sport;
 212         r->id.idiag_dport     = tw->tw_dport;
 213         r->id.idiag_src[0]    = tw->tw_rcv_saddr;
 214         r->id.idiag_dst[0]    = tw->tw_daddr;
 215         r->idiag_state        = tw->tw_substate;
 216         r->idiag_timer        = 3;
 217         r->idiag_expires      = DIV_ROUND_UP(tmo * 1000, HZ);
 218         r->idiag_rqueue       = 0;
 219         r->idiag_wqueue       = 0;
 220         r->idiag_uid          = 0;
 221         r->idiag_inode        = 0;
 222 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 223         if (tw->tw_family == AF_INET6) {
 224                 const struct inet6_timewait_sock *tw6 =
 225                                                 inet6_twsk((struct sock *)tw);
 226
 227                 *(struct in6_addr *)r->id.idiag_src = tw6->tw_v6_rcv_saddr;
 228                 *(struct in6_addr *)r->id.idiag_dst = tw6->tw_v6_daddr;
 229         }
 230 #endif
 231         nlh->nlmsg_len = skb_tail_pointer(skb) - previous_tail;
 232         return skb->len;
 233 nlmsg_failure:
 234         nlmsg_trim(skb, previous_tail);
 235         return -EMSGSIZE;
 236 }
 237
 238 static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
 239                         struct inet_diag_req *r, u32 pid, u32 seq, u16 nlmsg_flags,
 240                         const struct nlmsghdr *unlh)
 241 {
 242         if (sk->sk_state == TCP_TIME_WAIT)
 243                 return inet_twsk_diag_fill((struct inet_timewait_sock *)sk,
 244                                            skb, r, pid, seq, nlmsg_flags,
 245                                            unlh);
 246         return inet_csk_diag_fill(sk, skb, r, pid, seq, nlmsg_flags, unlh);
 247 }
 248
 249 static int inet_diag_get_exact(struct sk_buff *in_skb,
 250                                const struct nlmsghdr *nlh,
 251                                struct inet_diag_req *req)
 252 {
 253         int err;
 254         struct sock *sk;
 255         struct sk_buff *rep;
 256         struct inet_hashinfo *hashinfo;
 257         const struct inet_diag_handler *handler;
 258
 259         handler = inet_diag_lock_handler(req->sdiag_protocol);
 260         if (IS_ERR(handler)) {
 261                 err = PTR_ERR(handler);
 262                 goto unlock;
 263         }
 264
 265         hashinfo = handler->idiag_hashinfo;
 266         err = -EINVAL;
 267
 268         if (req->sdiag_family == AF_INET) {
 269                 sk = inet_lookup(&init_net, hashinfo, req->id.idiag_dst[0],
 270                                  req->id.idiag_dport, req->id.idiag_src[0],
 271                                  req->id.idiag_sport, req->id.idiag_if);
 272         }
 273 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 274         else if (req->sdiag_family == AF_INET6) {
 275                 sk = inet6_lookup(&init_net, hashinfo,
 276                                   (struct in6_addr *)req->id.idiag_dst,
 277                                   req->id.idiag_dport,
 278                                   (struct in6_addr *)req->id.idiag_src,
 279                                   req->id.idiag_sport,
 280                                   req->id.idiag_if);
 281         }
 282 #endif
 283         else {
 284                 goto unlock;
 285         }
 286
 287         err = -ENOENT;
 288         if (sk == NULL)
 289                 goto unlock;
 290
 291         err = -ESTALE;
 292         if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
 293              req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
 294             ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
 295              (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
 296                 goto out;
 297
 298         err = -ENOMEM;
 299         rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
 300                                      sizeof(struct inet_diag_meminfo) +
 301                                      sizeof(struct tcp_info) + 64)),
 302                         GFP_KERNEL);
 303         if (!rep)
 304                 goto out;
 305
 306         err = sk_diag_fill(sk, rep, req,
 307                            NETLINK_CB(in_skb).pid,
 308                            nlh->nlmsg_seq, 0, nlh);
 309         if (err < 0) {
 310                 WARN_ON(err == -EMSGSIZE);
 311                 kfree_skb(rep);
 312                 goto out;
 313         }
 314         err = netlink_unicast(sock_diag_nlsk, rep, NETLINK_CB(in_skb).pid,
 315                               MSG_DONTWAIT);
 316         if (err > 0)
 317                 err = 0;
 318
 319 out:
 320         if (sk) {
 321                 if (sk->sk_state == TCP_TIME_WAIT)
 322                         inet_twsk_put((struct inet_timewait_sock *)sk);
 323                 else
 324                         sock_put(sk);
 325         }
 326 unlock:
 327         inet_diag_unlock_handler(handler);
 328         return err;
 329 }
 330
 331 static int bitstring_match(const __be32 *a1, const __be32 *a2, int bits)
 332 {
 333         int words = bits >> 5;
 334
 335         bits &= 0x1f;
 336
 337         if (words) {
 338                 if (memcmp(a1, a2, words << 2))
 339                         return 0;
 340         }
 341         if (bits) {
 342                 __be32 w1, w2;
 343                 __be32 mask;
 344
 345                 w1 = a1[words];
 346                 w2 = a2[words];
 347
 348                 mask = htonl((0xffffffff) << (32 - bits));
 349
 350                 if ((w1 ^ w2) & mask)
 351                         return 0;
 352         }
 353
 354         return 1;
 355 }
 356
 357
 358 static int inet_diag_bc_run(const void *bc, int len,
 359                             const struct inet_diag_entry *entry)
 360 {
 361         while (len > 0) {
 362                 int yes = 1;
 363                 const struct inet_diag_bc_op *op = bc;
 364
 365                 switch (op->code) {
 366                 case INET_DIAG_BC_NOP:
 367                         break;
 368                 case INET_DIAG_BC_JMP:
 369                         yes = 0;
 370                         break;
 371                 case INET_DIAG_BC_S_GE:
 372                         yes = entry->sport >= op[1].no;
 373                         break;
 374                 case INET_DIAG_BC_S_LE:
 375                         yes = entry->sport <= op[1].no;
 376                         break;
 377                 case INET_DIAG_BC_D_GE:
 378                         yes = entry->dport >= op[1].no;
 379                         break;
 380                 case INET_DIAG_BC_D_LE:
 381                         yes = entry->dport <= op[1].no;
 382                         break;
 383                 case INET_DIAG_BC_AUTO:
 384                         yes = !(entry->userlocks & SOCK_BINDPORT_LOCK);
 385                         break;
 386                 case INET_DIAG_BC_S_COND:
 387                 case INET_DIAG_BC_D_COND: {
 388                         struct inet_diag_hostcond *cond;
 389                         __be32 *addr;
 390
 391                         cond = (struct inet_diag_hostcond *)(op + 1);
 392                         if (cond->port != -1 &&
 393                             cond->port != (op->code == INET_DIAG_BC_S_COND ?
 394                                              entry->sport : entry->dport)) {
 395                                 yes = 0;
 396                                 break;
 397                         }
 398
 399                         if (cond->prefix_len == 0)
 400                                 break;
 401
 402                         if (op->code == INET_DIAG_BC_S_COND)
 403                                 addr = entry->saddr;
 404                         else
 405                                 addr = entry->daddr;
 406
 407                         if (bitstring_match(addr, cond->addr,
 408                                             cond->prefix_len))
 409                                 break;
 410                         if (entry->family == AF_INET6 &&
 411                             cond->family == AF_INET) {
 412                                 if (addr[0] == 0 && addr[1] == 0 &&
 413                                     addr[2] == htonl(0xffff) &&
 414                                     bitstring_match(addr + 3, cond->addr,
 415                                                     cond->prefix_len))
 416                                         break;
 417                         }
 418                         yes = 0;
 419                         break;
 420                 }
 421                 }
 422
 423                 if (yes) {
 424                         len -= op->yes;
 425                         bc += op->yes;
 426                 } else {
 427                         len -= op->no;
 428                         bc += op->no;
 429                 }
 430         }
 431         return len == 0;
 432 }
 433
 434 static int valid_cc(const void *bc, int len, int cc)
 435 {
 436         while (len >= 0) {
 437                 const struct inet_diag_bc_op *op = bc;
 438
 439                 if (cc > len)
 440                         return 0;
 441                 if (cc == len)
 442                         return 1;
 443                 if (op->yes < 4 || op->yes & 3)
 444                         return 0;
 445                 len -= op->yes;
 446                 bc  += op->yes;
 447         }
 448         return 0;
 449 }
 450
 451 static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
 452 {
 453         const void *bc = bytecode;
 454         int  len = bytecode_len;
 455
 456         while (len > 0) {
 457                 const struct inet_diag_bc_op *op = bc;
 458
 459 //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
 460                 switch (op->code) {
 461                 case INET_DIAG_BC_AUTO:
 462                 case INET_DIAG_BC_S_COND:
 463                 case INET_DIAG_BC_D_COND:
 464                 case INET_DIAG_BC_S_GE:
 465                 case INET_DIAG_BC_S_LE:
 466                 case INET_DIAG_BC_D_GE:
 467                 case INET_DIAG_BC_D_LE:
 468                 case INET_DIAG_BC_JMP:
 469                         if (op->no < 4 || op->no > len + 4 || op->no & 3)
 470                                 return -EINVAL;
 471                         if (op->no < len &&
 472                             !valid_cc(bytecode, bytecode_len, len - op->no))
 473                                 return -EINVAL;
 474                         break;
 475                 case INET_DIAG_BC_NOP:
 476                         break;
 477                 default:
 478                         return -EINVAL;
 479                 }
 480                 if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
 481                         return -EINVAL;
 482                 bc  += op->yes;
 483                 len -= op->yes;
 484         }
 485         return len == 0 ? 0 : -EINVAL;
 486 }
 487
 488 static int inet_csk_diag_dump(struct sock *sk,
 489                               struct sk_buff *skb,
 490                               struct netlink_callback *cb,
 491                               struct inet_diag_req *r,
 492                               const struct nlattr *bc)
 493 {
 494         if (bc != NULL) {
 495                 struct inet_diag_entry entry;
 496                 struct inet_sock *inet = inet_sk(sk);
 497
 498                 entry.family = sk->sk_family;
 499 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 500                 if (entry.family == AF_INET6) {
 501                         struct ipv6_pinfo *np = inet6_sk(sk);
 502
 503                         entry.saddr = np->rcv_saddr.s6_addr32;
 504                         entry.daddr = np->daddr.s6_addr32;
 505                 } else
 506 #endif
 507                 {
 508                         entry.saddr = &inet->inet_rcv_saddr;
 509                         entry.daddr = &inet->inet_daddr;
 510                 }
 511                 entry.sport = inet->inet_num;
 512                 entry.dport = ntohs(inet->inet_dport);
 513                 entry.userlocks = sk->sk_userlocks;
 514
 515                 if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
 516                         return 0;
 517         }
 518
 519         return inet_csk_diag_fill(sk, skb, r,
 520                                   NETLINK_CB(cb->skb).pid,
 521                                   cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
 522 }
 523
 524 static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
 525                                struct sk_buff *skb,
 526                                struct netlink_callback *cb,
 527                                struct inet_diag_req *r,
 528                                const struct nlattr *bc)
 529 {
 530         if (bc != NULL) {
 531                 struct inet_diag_entry entry;
 532
 533                 entry.family = tw->tw_family;
 534 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 535                 if (tw->tw_family == AF_INET6) {
 536                         struct inet6_timewait_sock *tw6 =
 537                                                 inet6_twsk((struct sock *)tw);
 538                         entry.saddr = tw6->tw_v6_rcv_saddr.s6_addr32;
 539                         entry.daddr = tw6->tw_v6_daddr.s6_addr32;
 540                 } else
 541 #endif
 542                 {
 543                         entry.saddr = &tw->tw_rcv_saddr;
 544                         entry.daddr = &tw->tw_daddr;
 545                 }
 546                 entry.sport = tw->tw_num;
 547                 entry.dport = ntohs(tw->tw_dport);
 548                 entry.userlocks = 0;
 549
 550                 if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
 551                         return 0;
 552         }
 553
 554         return inet_twsk_diag_fill(tw, skb, r,
 555                                    NETLINK_CB(cb->skb).pid,
 556                                    cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
 557 }
 558
 559 static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
 560                               struct request_sock *req, u32 pid, u32 seq,
 561                               const struct nlmsghdr *unlh)
 562 {
 563         const struct inet_request_sock *ireq = inet_rsk(req);
 564         struct inet_sock *inet = inet_sk(sk);
 565         unsigned char *b = skb_tail_pointer(skb);
 566         struct inet_diag_msg *r;
 567         struct nlmsghdr *nlh;
 568         long tmo;
 569
 570         nlh = NLMSG_PUT(skb, pid, seq, unlh->nlmsg_type, sizeof(*r));
 571         nlh->nlmsg_flags = NLM_F_MULTI;
 572         r = NLMSG_DATA(nlh);
 573
 574         r->idiag_family = sk->sk_family;
 575         r->idiag_state = TCP_SYN_RECV;
 576         r->idiag_timer = 1;
 577         r->idiag_retrans = req->retrans;
 578
 579         r->id.idiag_if = sk->sk_bound_dev_if;
 580         r->id.idiag_cookie[0] = (u32)(unsigned long)req;
 581         r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
 582
 583         tmo = req->expires - jiffies;
 584         if (tmo < 0)
 585                 tmo = 0;
 586
 587         r->id.idiag_sport = inet->inet_sport;
 588         r->id.idiag_dport = ireq->rmt_port;
 589         r->id.idiag_src[0] = ireq->loc_addr;
 590         r->id.idiag_dst[0] = ireq->rmt_addr;
 591         r->idiag_expires = jiffies_to_msecs(tmo);
 592         r->idiag_rqueue = 0;
 593         r->idiag_wqueue = 0;
 594         r->idiag_uid = sock_i_uid(sk);
 595         r->idiag_inode = 0;
 596 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 597         if (r->idiag_family == AF_INET6) {
 598                 *(struct in6_addr *)r->id.idiag_src = inet6_rsk(req)->loc_addr;
 599                 *(struct in6_addr *)r->id.idiag_dst = inet6_rsk(req)->rmt_addr;
 600         }
 601 #endif
 602         nlh->nlmsg_len = skb_tail_pointer(skb) - b;
 603
 604         return skb->len;
 605
 606 nlmsg_failure:
 607         nlmsg_trim(skb, b);
 608         return -1;
 609 }
 610
 611 static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
 612                                struct netlink_callback *cb,
 613                                struct inet_diag_req *r,
 614                                const struct nlattr *bc)
 615 {
 616         struct inet_diag_entry entry;
 617         struct inet_connection_sock *icsk = inet_csk(sk);
 618         struct listen_sock *lopt;
 619         struct inet_sock *inet = inet_sk(sk);
 620         int j, s_j;
 621         int reqnum, s_reqnum;
 622         int err = 0;
 623
 624         s_j = cb->args[3];
 625         s_reqnum = cb->args[4];
 626
 627         if (s_j > 0)
 628                 s_j--;
 629
 630         entry.family = sk->sk_family;
 631
 632         read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
 633
 634         lopt = icsk->icsk_accept_queue.listen_opt;
 635         if (!lopt || !lopt->qlen)
 636                 goto out;
 637
 638         if (bc != NULL) {
 639                 entry.sport = inet->inet_num;
 640                 entry.userlocks = sk->sk_userlocks;
 641         }
 642
 643         for (j = s_j; j < lopt->nr_table_entries; j++) {
 644                 struct request_sock *req, *head = lopt->syn_table[j];
 645
 646                 reqnum = 0;
 647                 for (req = head; req; reqnum++, req = req->dl_next) {
 648                         struct inet_request_sock *ireq = inet_rsk(req);
 649
 650                         if (reqnum < s_reqnum)
 651                                 continue;
 652                         if (r->id.idiag_dport != ireq->rmt_port &&
 653                             r->id.idiag_dport)
 654                                 continue;
 655
 656                         if (bc) {
 657                                 entry.saddr =
 658 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 659                                         (entry.family == AF_INET6) ?
 660                                         inet6_rsk(req)->loc_addr.s6_addr32 :
 661 #endif
 662                                         &ireq->loc_addr;
 663                                 entry.daddr =
 664 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 665                                         (entry.family == AF_INET6) ?
 666                                         inet6_rsk(req)->rmt_addr.s6_addr32 :
 667 #endif
 668                                         &ireq->rmt_addr;
 669                                 entry.dport = ntohs(ireq->rmt_port);
 670
 671                                 if (!inet_diag_bc_run(nla_data(bc),
 672                                                       nla_len(bc), &entry))
 673                                         continue;
 674                         }
 675
 676                         err = inet_diag_fill_req(skb, sk, req,
 677                                                NETLINK_CB(cb->skb).pid,
 678                                                cb->nlh->nlmsg_seq, cb->nlh);
 679                         if (err < 0) {
 680                                 cb->args[3] = j + 1;
 681                                 cb->args[4] = reqnum;
 682                                 goto out;
 683                         }
 684                 }
 685
 686                 s_reqnum = 0;
 687         }
 688
 689 out:
 690         read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
 691
 692         return err;
 693 }
 694
 695 static int __inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 696                 struct inet_diag_req *r, struct nlattr *bc)
 697 {
 698         int i, num;
 699         int s_i, s_num;
 700         const struct inet_diag_handler *handler;
 701         struct inet_hashinfo *hashinfo;
 702
 703         handler = inet_diag_lock_handler(r->sdiag_protocol);
 704         if (IS_ERR(handler))
 705                 goto unlock;
 706
 707         hashinfo = handler->idiag_hashinfo;
 708
 709         s_i = cb->args[1];
 710         s_num = num = cb->args[2];
 711
 712         if (cb->args[0] == 0) {
 713                 if (!(r->idiag_states & (TCPF_LISTEN | TCPF_SYN_RECV)))
 714                         goto skip_listen_ht;
 715
 716                 for (i = s_i; i < INET_LHTABLE_SIZE; i++) {
 717                         struct sock *sk;
 718                         struct hlist_nulls_node *node;
 719                         struct inet_listen_hashbucket *ilb;
 720
 721                         num = 0;
 722                         ilb = &hashinfo->listening_hash[i];
 723                         spin_lock_bh(&ilb->lock);
 724                         sk_nulls_for_each(sk, node, &ilb->head) {
 725                                 struct inet_sock *inet = inet_sk(sk);
 726
 727                                 if (num < s_num) {
 728                                         num++;
 729                                         continue;
 730                                 }
 731
 732                                 if (r->sdiag_family != AF_UNSPEC &&
 733                                                 sk->sk_family != r->sdiag_family)
 734                                         goto next_listen;
 735
 736                                 if (r->id.idiag_sport != inet->inet_sport &&
 737                                     r->id.idiag_sport)
 738                                         goto next_listen;
 739
 740                                 if (!(r->idiag_states & TCPF_LISTEN) ||
 741                                     r->id.idiag_dport ||
 742                                     cb->args[3] > 0)
 743                                         goto syn_recv;
 744
 745                                 if (inet_csk_diag_dump(sk, skb, cb, r, bc) < 0) {
 746                                         spin_unlock_bh(&ilb->lock);
 747                                         goto done;
 748                                 }
 749
 750 syn_recv:
 751                                 if (!(r->idiag_states & TCPF_SYN_RECV))
 752                                         goto next_listen;
 753
 754                                 if (inet_diag_dump_reqs(skb, sk, cb, r, bc) < 0) {
 755                                         spin_unlock_bh(&ilb->lock);
 756                                         goto done;
 757                                 }
 758
 759 next_listen:
 760                                 cb->args[3] = 0;
 761                                 cb->args[4] = 0;
 762                                 ++num;
 763                         }
 764                         spin_unlock_bh(&ilb->lock);
 765
 766                         s_num = 0;
 767                         cb->args[3] = 0;
 768                         cb->args[4] = 0;
 769                 }
 770 skip_listen_ht:
 771                 cb->args[0] = 1;
 772                 s_i = num = s_num = 0;
 773         }
 774
 775         if (!(r->idiag_states & ~(TCPF_LISTEN | TCPF_SYN_RECV)))
 776                 goto unlock;
 777
 778         for (i = s_i; i <= hashinfo->ehash_mask; i++) {
 779                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
 780                 spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
 781                 struct sock *sk;
 782                 struct hlist_nulls_node *node;
 783
 784                 num = 0;
 785
 786                 if (hlist_nulls_empty(&head->chain) &&
 787                         hlist_nulls_empty(&head->twchain))
 788                         continue;
 789
 790                 if (i > s_i)
 791                         s_num = 0;
 792
 793                 spin_lock_bh(lock);
 794                 sk_nulls_for_each(sk, node, &head->chain) {
 795                         struct inet_sock *inet = inet_sk(sk);
 796
 797                         if (num < s_num)
 798                                 goto next_normal;
 799                         if (!(r->idiag_states & (1 << sk->sk_state)))
 800                                 goto next_normal;
 801                         if (r->sdiag_family != AF_UNSPEC &&
 802                                         sk->sk_family != r->sdiag_family)
 803                                 goto next_normal;
 804                         if (r->id.idiag_sport != inet->inet_sport &&
 805                             r->id.idiag_sport)
 806                                 goto next_normal;
 807                         if (r->id.idiag_dport != inet->inet_dport &&
 808                             r->id.idiag_dport)
 809                                 goto next_normal;
 810                         if (inet_csk_diag_dump(sk, skb, cb, r, bc) < 0) {
 811                                 spin_unlock_bh(lock);
 812                                 goto done;
 813                         }
 814 next_normal:
 815                         ++num;
 816                 }
 817
 818                 if (r->idiag_states & TCPF_TIME_WAIT) {
 819                         struct inet_timewait_sock *tw;
 820
 821                         inet_twsk_for_each(tw, node,
 822                                     &head->twchain) {
 823
 824                                 if (num < s_num)
 825                                         goto next_dying;
 826                                 if (r->sdiag_family != AF_UNSPEC &&
 827                                                 tw->tw_family != r->sdiag_family)
 828                                         goto next_dying;
 829                                 if (r->id.idiag_sport != tw->tw_sport &&
 830                                     r->id.idiag_sport)
 831                                         goto next_dying;
 832                                 if (r->id.idiag_dport != tw->tw_dport &&
 833                                     r->id.idiag_dport)
 834                                         goto next_dying;
 835                                 if (inet_twsk_diag_dump(tw, skb, cb, r, bc) < 0) {
 836                                         spin_unlock_bh(lock);
 837                                         goto done;
 838                                 }
 839 next_dying:
 840                                 ++num;
 841                         }
 842                 }
 843                 spin_unlock_bh(lock);
 844         }
 845
 846 done:
 847         cb->args[1] = i;
 848         cb->args[2] = num;
 849 unlock:
 850         inet_diag_unlock_handler(handler);
 851         return skb->len;
 852 }
 853
 854 static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
 855 {
 856         struct nlattr *bc = NULL;
 857         int hdrlen = sizeof(struct inet_diag_req);
 858
 859         if (nlmsg_attrlen(cb->nlh, hdrlen))
 860                 bc = nlmsg_find_attr(cb->nlh, hdrlen, INET_DIAG_REQ_BYTECODE);
 861
 862         return __inet_diag_dump(skb, cb, (struct inet_diag_req *)NLMSG_DATA(cb->nlh), bc);
 863 }
 864
 865 static inline int inet_diag_type2proto(int type)
 866 {
 867         switch (type) {
 868         case TCPDIAG_GETSOCK:
 869                 return IPPROTO_TCP;
 870         case DCCPDIAG_GETSOCK:
 871                 return IPPROTO_DCCP;
 872         default:
 873                 return 0;
 874         }
 875 }
 876
 877 static int inet_diag_dump_compat(struct sk_buff *skb, struct netlink_callback *cb)
 878 {
 879         struct inet_diag_req_compat *rc = NLMSG_DATA(cb->nlh);
 880         struct inet_diag_req req;
 881         struct nlattr *bc = NULL;
 882         int hdrlen = sizeof(struct inet_diag_req_compat);
 883
 884         req.sdiag_family = AF_UNSPEC; /* compatibility */
 885         req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type);
 886         req.idiag_ext = rc->idiag_ext;
 887         req.idiag_states = rc->idiag_states;
 888         req.id = rc->id;
 889
 890         if (nlmsg_attrlen(cb->nlh, hdrlen))
 891                 bc = nlmsg_find_attr(cb->nlh, hdrlen, INET_DIAG_REQ_BYTECODE);
 892
 893         return __inet_diag_dump(skb, cb, &req, bc);
 894 }
 895
 896 static int inet_diag_get_exact_compat(struct sk_buff *in_skb,
 897                                const struct nlmsghdr *nlh)
 898 {
 899         struct inet_diag_req_compat *rc = NLMSG_DATA(nlh);
 900         struct inet_diag_req req;
 901
 902         req.sdiag_family = rc->idiag_family;
 903         req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type);
 904         req.idiag_ext = rc->idiag_ext;
 905         req.idiag_states = rc->idiag_states;
 906         req.id = rc->id;
 907
 908         return inet_diag_get_exact(in_skb, nlh, &req);
 909 }
 910
 911 static int inet_diag_rcv_msg_compat(struct sk_buff *skb, struct nlmsghdr *nlh)
 912 {
 913         int hdrlen = sizeof(struct inet_diag_req_compat);
 914
 915         if (nlh->nlmsg_type >= INET_DIAG_GETSOCK_MAX ||
 916             nlmsg_len(nlh) < hdrlen)
 917                 return -EINVAL;
 918
 919         if (nlh->nlmsg_flags & NLM_F_DUMP) {
 920                 if (nlmsg_attrlen(nlh, hdrlen)) {
 921                         struct nlattr *attr;
 922
 923                         attr = nlmsg_find_attr(nlh, hdrlen,
 924                                                INET_DIAG_REQ_BYTECODE);
 925                         if (attr == NULL ||
 926                             nla_len(attr) < sizeof(struct inet_diag_bc_op) ||
 927                             inet_diag_bc_audit(nla_data(attr), nla_len(attr)))
 928                                 return -EINVAL;
 929                 }
 930
 931                 return netlink_dump_start(sock_diag_nlsk, skb, nlh,
 932                                           inet_diag_dump_compat, NULL, 0);
 933         }
 934
 935         return inet_diag_get_exact_compat(skb, nlh);
 936 }
 937
 938 static int inet_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
 939 {
 940         int hdrlen = sizeof(struct inet_diag_req);
 941
 942         if (nlmsg_len(h) < hdrlen)
 943                 return -EINVAL;
 944
 945         if (h->nlmsg_flags & NLM_F_DUMP) {
 946                 if (nlmsg_attrlen(h, hdrlen)) {
 947                         struct nlattr *attr;
 948                         attr = nlmsg_find_attr(h, hdrlen,
 949                                                INET_DIAG_REQ_BYTECODE);
 950                         if (attr == NULL ||
 951                             nla_len(attr) < sizeof(struct inet_diag_bc_op) ||
 952                             inet_diag_bc_audit(nla_data(attr), nla_len(attr)))
 953                                 return -EINVAL;
 954                 }
 955
 956                 return netlink_dump_start(sock_diag_nlsk, skb, h,
 957                                           inet_diag_dump, NULL, 0);
 958         }
 959
 960         return inet_diag_get_exact(skb, h, (struct inet_diag_req *)NLMSG_DATA(h));
 961 }
 962
 963 static struct sock_diag_handler inet_diag_handler = {
 964         .family = AF_INET,
 965         .dump = inet_diag_handler_dump,
 966 };
 967
 968 static struct sock_diag_handler inet6_diag_handler = {
 969         .family = AF_INET6,
 970         .dump = inet_diag_handler_dump,
 971 };
 972
 973 int inet_diag_register(const struct inet_diag_handler *h)
 974 {
 975         const __u16 type = h->idiag_type;
 976         int err = -EINVAL;
 977
 978         if (type >= IPPROTO_MAX)
 979                 goto out;
 980
 981         mutex_lock(&inet_diag_table_mutex);
 982         err = -EEXIST;
 983         if (inet_diag_table[type] == NULL) {
 984                 inet_diag_table[type] = h;
 985                 err = 0;
 986         }
 987         mutex_unlock(&inet_diag_table_mutex);
 988 out:
 989         return err;
 990 }
 991 EXPORT_SYMBOL_GPL(inet_diag_register);
 992
 993 void inet_diag_unregister(const struct inet_diag_handler *h)
 994 {
 995         const __u16 type = h->idiag_type;
 996
 997         if (type >= IPPROTO_MAX)
 998                 return;
 999
1000         mutex_lock(&inet_diag_table_mutex);
1001         inet_diag_table[type] = NULL;
1002         mutex_unlock(&inet_diag_table_mutex);
1003 }
1004 EXPORT_SYMBOL_GPL(inet_diag_unregister);
1005
1006 static int __init inet_diag_init(void)
1007 {
1008         const int inet_diag_table_size = (IPPROTO_MAX *
1009                                           sizeof(struct inet_diag_handler *));
1010         int err = -ENOMEM;
1011
1012         inet_diag_table = kzalloc(inet_diag_table_size, GFP_KERNEL);
1013         if (!inet_diag_table)
1014                 goto out;
1015
1016         err = sock_diag_register(&inet_diag_handler);
1017         if (err)
1018                 goto out_free_nl;
1019
1020         err = sock_diag_register(&inet6_diag_handler);
1021         if (err)
1022                 goto out_free_inet;
1023
1024         sock_diag_register_inet_compat(inet_diag_rcv_msg_compat);
1025 out:
1026         return err;
1027
1028 out_free_inet:
1029         sock_diag_unregister(&inet_diag_handler);
1030 out_free_nl:
1031         kfree(inet_diag_table);
1032         goto out;
1033 }
1034
1035 static void __exit inet_diag_exit(void)
1036 {
1037         sock_diag_unregister(&inet6_diag_handler);
1038         sock_diag_unregister(&inet_diag_handler);
1039         sock_diag_unregister_inet_compat(inet_diag_rcv_msg_compat);
1040         kfree(inet_diag_table);
1041 }
1042
1043 module_init(inet_diag_init);
1044 module_exit(inet_diag_exit);
1045 MODULE_LICENSE("GPL");
1046 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 0);